CN110166256B - SM9 digital signature multi-party collaborative generation method and system with product r parameter - Google Patents

Abstract

The invention relates to SM9 digital signaturesThe generation method comprises the following steps: m devices numbered 1 to m hold [1, n-1 ] respectively]Integer secret c in (1)_iN is the order of SM9 group, i is 1, …, m is more than or equal to 2; p_A＝[(c₁+c₂+…+c_m)^‑1]d_A，P_B＝[b]d_A，d_AB is a private key of the user and is [1, n-1 ] unknown to all m devices]An integer secret within; when required to use d_AWhen signing the message, the calculation results in w ═ g_B^(r₁r₂…r_m)，h＝H₂(M||w,n)，Q₁＝[(r₂r₃…r_m)^‑1]P_A，Q₂＝[(r₃…r_m)^‑1]P_A，Q_m‑1＝[(r_m)^‑1]P_ATaking Q_m＝P_A,S₀＝P_B(ii) a m devices recursively calculating S_i＝[r_i]S_i‑1+[‑c_ih]Q_iLet S be S_mThen (h, S) is a digital signature for the message.

Description

SM9 digital signature multi-party collaborative generation method and system with product r parameter

Technical Field

The invention belongs to the technical field of information security, and particularly relates to a SM9 digital signature multi-party collaborative generation method and system with a product r parameter.

Background

SM9 is an identification cryptographic algorithm issued by the national crypto authority based on bilinear mapping (pairing operation), wherein the bilinear mapping (pairing operation) is:

e：G₁×G₂→G_Tin which G is₁、G₂Is an additive cyclic group, G_TIs a multiplication loop group, G₁、G₂、G_TIs a prime number n (note: in the SM9 specification, G₁、G₂、G_TThe order of (A) is given by the capital letter N, and the present application uses the lower case N), i.e. if P, Q, R are each G₁、G₂In (b), e (P, Q) is G_TAnd:

e(P+R,Q)＝e(P,Q)e(R,Q)，

e(P,Q+R)＝e(P,Q)e(P,R)，

e(aP,bQ)＝e(P,Q)^ab。

the SM 9-based cryptographic algorithm can realize digital signature based on identification, key exchange and data encryption. In the SM9 cryptographic algorithm, the user's SM9 private key d is used_AThe process of generating a digital signature for message M is as follows:

the calculation yields w ═ g ^ r, where the symbol ^ represents the power operation (the r-th power of g), and r is at [1, n-1 ^ r]Randomly selected integer within the interval, n being the group G of the SM9 cryptographic algorithm₁、G₂、G_TG ═ e (P)₁,P_pub)，P₁Is G₁In (1)Generator, P_pubIs the master public key (i.e. P)_pub＝[s]P₂S is a master private or master key, P₂Is G₂See SM9 specification; note that here the primary private key or key, the primary public key, the sign used by the user identification private key is slightly different from the SM9 specification);

then, H is calculated as H₂(M | | w, n), wherein H₂For the hash function specified in SM9, M | | | w represents the merging of strings of M and w, and n is G₁、G₂、G_T(iii) order (see SM9 specification);

if r ≠ h, calculate S [ [ r-h ≠ h]d_AThen (h, S) is the generated digital signature; and if r is equal to h, reselecting r, and recalculating w and h until r is not equal to h.

For special requirements, for example, to ensure the security of the use of the private key of the user in a non-hardware environment, some methods for generating the SM9 digital signature based on secret sharing (sharing) have been proposed. In these methods, a plurality of devices each hold a secret share of the private key of the user SM9, or each hold a secret share of a secret related to the private key; when a digital signature needs to be generated for one message M by using a user private key, each device interacts and cooperates with other devices by using the secret share of the device, and the digital signature for the message is generated.

The existing SM9 digital signature collaborative generation scheme based on secret sharing usually calculates w ═ g ^ (a) in the process of cryptographic operation₁r₁+...+a_mr_m) Wherein r is_iIs the ith device in [1, n-1 ]]Of a randomly selected integer, and a_iIs a constant, i 1.., m (assuming m devices); then H is calculated₂(M | | w, n), and the last M devices obtain S ═ a [ (a) through cooperative calculation₁r₁+...+a_mr_m)-h]d_A. This solution is generally not problematic, but there may be a situation where (a) happens to occur₁r₁+...+a_mr_m) mod n is 0 and this is observed by exactly one of the devices (e.g., by checking if w is a unit bit) but not reporting, then the device is configured to reportIt is possible to derive the user' S SM9 private key from the resulting digital signature (h, S). The probability of this occurring, although extremely small, is still likely to occur, particularly at r_iIn the case of a truly random selection, which is difficult to achieve.

The scheme adopted if the secret sharing-based digital signature collaborative generation scheme can achieve is w ═ g ^ (ar)₁...r_m)，S＝[(ar₁...r_m)-h]d_AI.e. r herein₁,...,r_mAnd a constant a is present in the form of a product, then it is not present (ar)₁...r_m) In the case of mod n being 0, such a scheme has higher security. We here handle r₁,...,r_mAnd the case where the constant a occurs in the form of a product is referred to as the case of the product r parameter, and r in the process of generating the digital signature is referred to as the case of the product r parameter₁,…,r_mAnd an SM9 digital signature cooperative generation method in which the constant a appears in the form of a product, referred to as an SM9 digital signature cooperative generation method with a product r parameter.

Disclosure of Invention

The invention aims to provide an SM9 digital signature multi-party collaborative generation technical scheme for enhancing safety, namely an SM9 digital signature multi-party collaborative generation technical scheme with a product r parameter, so as to enhance the safety of the SM9 digital signature collaborative generation technical scheme based on secret sharing.

Aiming at the purpose of the invention, the technical scheme provided by the invention comprises an SM9 digital signature multi-party collaborative generation method with a product r parameter and a corresponding system.

In the following description of the present invention, if P, Q is addition group G₁、G₂Where P + Q represents the addition of P, Q to the addition group, P-Q represents the inverse of P plus Q (addition inverse), and k]P represents the addition of k P's to the addition group, i.e., P + P +. + P (k total P) (if k is a negative number, the inverse of the result of the addition of | k | P's, where [, ]]The use of symbols is consistent with the SM9 specification);

an ellipsis ". -" represents a plurality of identical (types of) data items or a plurality of identical operations;

if a,b is a multiplicative group G_TWhere ab or a.b represents a, b in the multiplicative group G_TMultiplication of (a, ". may be omitted, as long as it does not produce ambiguity), a^-1Indicates that a is an inverse of a (multiplicative inverse) in a multiplicative group, a^tIndicates t a are in multiplicative group G_TUp-multiplication (t is a negative number, and is the inverse of | t | the multiplication result of a), i.e. exponentiation, a^tIs a ^ t;

if c is an integer, then c^-1Representing the modulo n inverse of integer c (i.e., cc)^-1mod n ═ 1); unless otherwise specified, the multiplicative inverse of the integer in the invention of this patent is for group G₁、G₂、G_TThe modulo n multiplication inverse of order n;

multiple integer multiplications (including integer-symbol multiplications, constant-integer-symbol multiplications), omitting the multiplication "·" as k, without ambiguity₁·k₂Simplified as k₁k₂3 · c, reduced to 3 c;

mod n denotes the modulo n operation (modulo operation), corresponding to modN in the SM9 specification; also, the operator mod n of the modulo n operation is of lowest priority, e.g., a + b mod n equals (a + b) mod n, a-b mod n equals (a-b) mod n, ab mod n equals (ab) mod n.

The SM9 digital signature multi-party collaborative generation method with the product r parameter provided by the invention is concretely as follows.

The method relates to m devices which are respectively marked as No. 1, No. 2, No. until No. m, wherein m is more than or equal to 2;

device No. i holds [1, n-1 ]]Integer secret c within interval_i1.. m, where n is group G in the SM9 cryptographic algorithm₁、G₂、G_TIs a prime number, and (c)₁+c₂+...+c_m)mod n≠0；

(initialization phase) pre-calculated are:

P_A＝[c^-1]d_Awherein d is_AIdentify the private key for the user's SM9, c^-1Modulo n multiplication inverse of c, c ═ c₁+c₂+...+c_m) mod n is m devices without guaranteesA stored integer secret;

P_B＝[b]d_Awherein b is [1, n-1 ]]None of the m devices within the interval have a saved integer secret;

b and c^-1Need not be different (different or the same);

g_Bg ^ b, where ^ is the exponentiation (exponentiation on the elements in front of ^ followed by the number of exponentiations), g ^ e (P ^ b)₁,P_pub)，P₁Is G₁The generator of (1), P_pubIs the master public key (i.e. P)_pub＝[s]P₂S is a master private or master key, P₂Is G₂See SM9 specification);

none of the m devices store d_A；

When it is desired to use the user's SM9 to identify the private key d_AWhen digitally signing a message M, M devices generate digital signatures as follows (the user's SM9 identification private key d needs to be used_AThe body that digitally signs for message M may be a cryptographic application, system or cryptographic module that invokes the M devices, or a cryptographic application, system in one of the M devices):

firstly, m devices obtain w ═ g through interactive calculation_B^(r₁r₂...r_m) Wherein r is_iThe device No. i is in [1, n-1 ] in the calculation process]An integer randomly selected within the interval, i ═ 1.., m;

then, H ═ H is calculated (by one of the m devices or the other device)₂(M | | w, n), wherein H₂For the hash function specified in SM9, M | | | w represents the merging of strings of M and w, and n is G₁、G₂、G_TThe order of (1);

(h free transfer as required without privacy)

Checking whether w is equal to g ^ h or not (one or other of the m devices), and if w is equal to g ^ h, the m devices perform calculation of w again until w is not equal to g ^ h;

then, Q is calculated₁＝[(r₂r₃...r_m)^-1]P_A，Q₂＝[(r₃...r_m)^-1]P_A，...，Q_m-1＝[(r_m)^-1]P_ATaking Q_m＝P_A；

Get S₀＝P_B；

Device number 1 calculates S₁＝[r₁]S₀+[-c₁h]Q₁Wherein r is₁And r when calculating w₁Same, then S₁To device No. 2;

the device No. i receives S_i-1Then, if S is found by inspection, i is 2_i-1If it is zero, error is reported, otherwise S is calculated_i＝[r_i]S_i-1+[-c_ih]Q_iWherein r is_iAnd r when calculating w_iThe same;

if i is m, then S is S_m(h, S) is the generated digital signature for the message M, otherwise, S is_iTransmitting to the device No. i +1 until S is completed_mAnd (4) calculating.

(where S is [ r ]₁r₂...r_m]P_B+[-c₁hr₂...r_m]Q₁+[-c₂hr₃...r_m]Q₂+...+[-c_m-1hr_m]Q_m-1+[-c_mh]Q_m＝[r₁r₂...r_m]P_B+[-(c₁+c₂+...+c_m)h]P_A＝[(r₁r₂...r_m)b-h]d_A)

For the above-mentioned SM9 digital signature multiparty collaborative generation method with the product r parameter, m devices calculate w-g_B^(r₁r₂...r_m) The method of (1) comprises (not all possible ways):

device No. 1 calculates g₁＝g_B^r₁G is mixing₁Transmitting device No. 2;

the device No. i receives g_i-1Then, i is 2_i＝g_i-1^r_i；

If i is m, then w is g_mFinish the calculation, otherwise, get the device g No. i_iTransmitting to the device No. i + 1;

alternatively, the first and second electrodes may be,

device m calculates g_m＝g_B^r_mG is mixing_mTransmitting the m-1 device;

the ith device receives g_i+1Then, i ═ m-1, calculate g_i＝g_i+1^r_i；

If i is 1, then w is g₁Finish the calculation, otherwise, get the device g No. i_iTo the device No. i-1.

For the above-mentioned SM9 digital signature multi-party collaborative generation method with the product r parameter, if it is not checked whether w is equal to g ^ h or not in the calculation process, after S is obtained by calculation, if (one or other devices of m devices) it is checked that S is zero, m devices perform collaborative calculation again until S is not zero.

For the SM9 digital signature multi-party collaborative generation method with the product r parameter, Q is obtained through calculation₁＝[(r₂r₃...r_m)^-1]P_A，Q₂＝[(r₃...r_m)^-1]P_A，...，Q_m-1＝[(r_m)^-1]P_AOne way of (2) is as follows:

device No. m takes Q_m＝P_ACalculating Q_m-1＝[(r_m)^-1]Q_mIs mixing Q with_m-1Sending the data to the device No. m-1;

device i receives Q_iThen, if i is m-1, …,1, and if i is 1, the device No. 1 will Q₁Temporarily reserved, complete Q₁,Q₂,...,Q_m-1Otherwise, the ith device calculates Q_i-1＝[(r_i)^-1]Q_iIs mixing Q with_iTemporarily reserve, Q_i-1To the device No. i-1.

Multi-party collaborative generator for SM9 digital signature with product r parameter as described aboveMethod if take c_m1 is equal to 0 and_Astored as a secret by the m-th device, and b ≠ c^-1(i.e. P)_B≠P_A) Then S is obtained by calculation according to the method_m(in this case [ -c ]_mh]Q_mZero) device m gets S ═ S_mAnd (h, S) is checked as validity of the digital signature of the message M, if valid, (h, S) is the digital signature for the message M, otherwise, the mth device reports an error.

On the basis of the SM9 digital signature multi-party collaborative generation method with the product r parameter, an SM9 digital signature collaborative generation system can be constructed, wherein the system comprises m devices which are respectively marked as No. 1, No. 2,. to No. m, and m is more than or equal to 2; device No. i holds [1, n-1 ]]Integer secret c within interval_iI 1.., m; when it is desired to use the user's SM9 to identify the private key d_AWhen the message M is digitally signed, the M devices generate the digital signature aiming at the message M according to the SM9 digital signature multiparty collaborative generation method with the product r parameter; in particular, if c is taken_mIs equal to 0, and P is_AStored as a secret by the m-th device, and b ≠ c^-1(i.e. P)_B≠P_A) Then S is calculated according to the SM9 digital signature multiparty collaborative generation method with the product r parameter_m(in this case [ -c ]_mh]Q_mZero) device m gets S ═ S_mAnd (h, S) is checked as validity of the digital signature of the message M, if valid, (h, S) is the digital signature for the message M, otherwise, the mth device reports an error.

From the foregoing description, it can be seen that by the method and system of the present invention, the user identification private key d is used when needed_AWhen the message is digitally signed, the plurality of devices can cooperatively generate the digital signature aiming at the message through interaction, and the product r parameter is adopted in the cooperative computing process, so that the method has higher safety.

Drawings

None.

Detailed Description

The present invention will be further described with reference to the following examples. The following examples are merely illustrative of a few possible embodiments of the present invention and are not intended to represent all possible embodiments and are not intended to limit the present invention.

Examples 1,

This embodiment has two devices numbered 1 and 2, device number 1 holding [1, n-1 [ ]]Integer secret c within interval₁Device No. 2 stores [1, n-1 ]]Integer secret c within interval₂Where n is group G in the SM9 cryptographic algorithm₁、G₂、G_TIs a prime number, and (c)₁+c₂)mod n≠0；

(initialization phase) pre-calculated are:

P_A＝[c^-1]d_Awherein d is_AIdentify the private key for the user's SM9, c^-1Modulo n multiplication inverse of c, c ═ c₁+c₂) mod n is an integer secret that neither device holds;

P_B＝[b]d_Awherein b is [1, n-1 ]]None of the m devices within the interval have a saved integer secret;

b and c^-1Need not be different (different or the same);

g_Bg ^ b, where ^ is the exponentiation (exponentiation on the elements in front of ^ followed by the number of exponentiations), g ^ e (P ^ b)₁,P_pub)，P₁Is G₁The generator of (1), P_pubIs the master public key (i.e. P)_pub＝[s]P₂S is a master private or master key, P₂Is G₂See SM9 specification);

neither device stores d_A；

When it is desired to use the user's SM9 to identify the private key d_AWhen the message M is digitally signed, the two devices firstly obtain w ═ g through interactive calculation_B^(r₁r₂) Wherein r is₁Is the device No. 1 in [1, n-1 ]]Randomly selected integer within the interval, r₂Is the device No. 2 in [1, n-1 ]]Randomly selected integers within the interval;

then, H ═ H is calculated (by one of the two devices or the other device)₂(M | | w, n), whichMiddle H₂For the hash function specified in SM9, M | | | w represents the merging of strings of M and w, and n is G₁、G₂、G_TThe order of (1);

checking whether w is equal to g ^ h or not (one or other of the two devices), and if w is equal to g ^ h, the two devices perform calculation of w again until w is not equal to g ^ h;

then, Q is calculated₁＝[(r₂)^-1]P_ATaking Q₂＝P_A；

Get S₀＝P_B；

Device number 1 calculates S₁＝[r₁]S₀+[-c₁h]Q₁Wherein r is₁And r when calculating w₁Same, then S₁To device No. 2;

device number 2 receives S₁Then, if the inspection finds S₁If it is zero, error is reported, otherwise S is calculated₂＝[r₂]S₁+[-c₂h]Q₂Wherein r is₂And r when calculating w₂The same;

taking S as S₂Then (h, S) is a digital signature for message M.

(where S is [ r ]₁r₂]P_B+[-c₁hr₂]Q₁+[-c₂h]Q₂＝[r₁r₂]P_B+[-(c₁+c₂)h]P_A

＝[(r₁r₂)b-h]d_A)

For this embodiment, during the initialization phase, d may be known_AIn (one of the two devices or one device other than the two devices) at [1, n-1 ]]In the random selection of two integers c₁、c₂Checking (c)₁+c₂) Whether mod n is 0 or not, and if so, at [1, n-1]Internal reselection of two integers c₁、c₂Up to (c)₁+c₂) mod n is not 0;

if (c)₁+c₂) mod n is not 0, then c is₁、c₂Respectively handed overDevices No. 1 and No. 2 are kept as secrets;

then, know d_AMeans for calculating P_A＝[c^-1]d_AWherein c is^-1Modulo n multiplication inverse of c, c ═ c₁+c₂) mod n; in [1, n-1 ]]Randomly selecting an integer b, and calculating P_B＝[b]d_A；

Finally P is added_A、P_BC, b and d are delivered to a required device for use_AAnd (4) destroying.

Examples 2,

This embodiment has m devices numbered 1, 2, through m ≧ 2, where device # i holds [1, n-1 ]]Integer secret c within interval_i1.. m, where n is group G in the SM9 cryptographic algorithm₁、G₂、G_TIs a prime number, and (c)₁+c₂+...+c_m)mod n≠0；

(initialization phase) pre-calculated are:

P_A＝[c^-1]d_Awherein d is_AIdentify the private key for the user's SM9, c ═ c₁+c₂+...+c_m) mod n is an integer secret that is not held by all m devices, c^-1The modulo-n multiplication inverse of c;

P_B＝[b]d_Awherein b is [1, n-1 ]]None of the m devices within the interval have a saved integer secret;

b and c^-1Need not be different (different or the same);

g_Bg ^ b, where ^ is the exponentiation (exponentiation on the elements in front of ^ followed by the number of exponentiations), g ^ e (P ^ b)₁,P_pub)，P₁Is G₁The generator of (1), P_pubIs the master public key (i.e. P)_pub＝[s]P₂S is a master private or master key, P₂Is G₂See SM9 specification);

none of the m devices store d_A；

When it is desired to use the user's SM9 to identify the private key d_AFor message MWhen in digital signature, m devices firstly obtain w-g through interactive calculation_B^(r₁r₂...r_m) Wherein r is_iThe device No. i is in [1, n-1 ] in the calculation process]An integer randomly selected within the interval, i ═ 1.., m;

then, H ═ H is calculated (by one of the m devices or the other device)₂(M | | w, n), wherein H₂For the hash function specified in SM9, M | | | w represents the merging of strings of M and w, and n is G₁、G₂、G_TThe order of (1);

(h free transfer as required without privacy)

Checking whether w is equal to g ^ h or not (one or other of the m devices), and if w is equal to g ^ h, the m devices perform calculation of w again until w is not equal to g ^ h;

then, Q is calculated₁＝[(r₂r₃...r_m)^-1]P_A，Q₂＝[(r₃...r_m)^-1]P_A，...，Q_m-1＝[(r_m)^-1]P_ATaking Q_m＝P_A；

Get S₀＝P_B；

Device number 1 calculates S₁＝[r₁]S₀+[-c₁h]Q₁Wherein r is₁And r when calculating w₁Same, then S₁To device No. 2;

the device No. i receives S_i-1Then, if S is found by inspection, i is 2_i-1If it is zero, error is reported, otherwise S is calculated_i＝[r_i]S_i-1+[-c_ih]Q_iWherein r is_iAnd r when calculating w_iThe same;

if i is m, then S is S_m(h, S) is the generated digital signature for the message M, otherwise, S is_iTo the device No. i + 1.

(where S is [ r ]₁r₂...r_m]P_B+[-c₁hr₂...r_m]Q₁+[-c₂hr₃...r_m]Q₂+...+[-c_m-1hr_m]Q_m-1+[-c_mh]Q_m＝[r₁r₂...r_m]P_B+[-(c₁+c₂+...+c_m)h]P_A＝[(r₁r₂...r_m)b-h]d_A)

For this embodiment, during the initialization phase, d may be known_AIn (one or more than one of the m devices) at [1, n-1 ]]In the random selection of m integers c_iI 1.., m, inspection (c)₁+c₂+...+c_m) Whether mod n is 0 or not, and if so, at [1, n-1]Reselecting m integers until (c)₁+c₂+...+c_m) mod n is not 0;

if (c)₁+c₂+...+c_m) mod n is not 0, then c is_iThe device I is handed to the device I to be kept as a secret, i is 1.

Then knows d_AMeans for calculating P_A＝[c^-1]d_AWherein c is^-1Modulo n multiplication inverse of c, c ═ c₁+c₂+...+c_m)mod n；

Then knows d_AIn [1, n-1 ]]Randomly selecting an integer b, and calculating P_B＝[b]d_A；

Finally P is added_A、P_BC, b, d to the required device_AAnd (4) destroying.

Examples 3,

This embodiment has two devices numbered 1 and 2, device number 1 holding [1, n-1 [ ]]Integer secret c within interval₁Where n is group G in the SM9 cryptographic algorithm₁、G₂、G_TThe order of (is a prime number); device number 2 holds a secret P_A＝[(c₁)^-1]d_A(at this time c₂0) where d is_AIdentify private key for user's SM9, (c)₁)^-1Is c₁The inverse of the modulo n multiplication of;

(initialization phase) pre-calculated are:

P_B＝[b]d_Awherein b is [1, n-1 ]]None of the m devices within the interval have a saved integer secret;

b and (c)₁)^-1Different;

g_Bg ^ b, where ^ is the exponentiation (exponentiation on the elements in front of ^ followed by the number of exponentiations), g ^ e (P ^ b)₁,P_pub)，P₁Is G₁The generator of (1), P_pubIs the master public key (i.e. P)_pub＝[s]P₂S is a master private or master key, P₂Is G₂See SM9 specification);

neither device stores d_A；

When it is desired to use the user's SM9 to identify the private key d_AWhen the message M is digitally signed, the two devices firstly obtain w ═ g through interactive calculation_B^(r₁r₂) Wherein r is₁Is the device No. 1 in [1, n-1 ]]Randomly selected integer within the interval, r₂Is the device No. 2 in [1, n-1 ]]Randomly selected integers within the interval;

then, H ═ H is calculated (by one of the two devices or the other device)₂(M | | w, n), wherein H₂For the hash function specified in SM9, M | | | w represents the merging of strings of M and w, and n is G₁、G₂、G_TThe order of (1);

checking whether w is equal to g ^ h or not (one or other of the two devices), and if w is equal to g ^ h, the two devices perform calculation of w again until w is not equal to g ^ h;

then, Q is calculated₁＝[(r₂)^-1]P_A；

Get S₀＝P_B；

Device number 1 calculates S₁＝[r₁]S₀+[-c₁h]Q₁Wherein r is₁And r when calculating w₁Same, then S₁To device No. 2;

device number 2 receives S₁Then, if the inspection finds S₁If it is zero, error is reported, otherwise S is calculated₂＝[r₂]S₁(at this time c₂0) where r is₂And r when calculating w₂The same;

device No. 2 gets S ═ S₂And checking the validity of the digital signature of the message M as (h, S), wherein if the digital signature of the message M is valid, (h, S) is the digital signature of the message M, and otherwise, the device No. 2 reports an error.

(where S is [ r ]₁r₂]P_B+[-c₁r₂h]Q₁＝[r₁r₂]P_B+[-c₁h]P_A＝[(r₁r₂)b-h]d_A)

For this embodiment, during the initialization phase, d may be known_AIn (one of the two devices or one device other than the two devices) at [1, n-1 ]]In the random selection of an integer c₁C is mixing₁The information is handed to the No. 1 device to be kept as secret; calculating P_A＝[(c₁)^-1]d_AA 1 is to P_ADelivered to device number 2 for secret storage (at this point c)₂0); knowing d_AIn [1, n-1 ]]An integer b is selected at random within the sequence and b ≠ (c)₁)^-1Calculate P_B＝[b]d_AA 1 is to P_BB, d are delivered to a required device_AAnd (4) destroying.

Examples 4,

This embodiment has m devices numbered 1, 2, through m, where m is 2 or more, and 1 through m-1 have [1, n-1 ] stored therein]Integer secret c within interval_i1., m-1, where n is group G in the SM9 cryptographic algorithm₁、G₂、G_TIs a prime number, and (c)₁+c₂+...+c_m-1) mod n ≠ 0; no. m device holds secret P_A＝[c^-1]d_AWherein d is_AIdentify the private key for the user's SM9, c^-1Modulo n multiplication inverse of c, c ═ c₁+c₂+...+c_m-1)mod n；

(initialization phase) pre-calculated are:

P_B＝[b]d_Awherein b isIs [1, n-1 ]]None of the m devices within the interval have a saved integer secret;

b and c^-1Different;

g_Bg ^ b, where ^ is the exponentiation (exponentiation on the elements in front of ^ followed by the number of exponentiations), g ^ e (P ^ b)₁,P_pub)，P₁Is G₁The generator of (1), P_pubIs the master public key (i.e. P)_pub＝[s]P₂S is a master private or master key, P₂Is G₂See SM9 specification);

none of the m devices store d_A；

When it is desired to use the user's SM9 to identify the private key d_AWhen a digital signature is performed on a message M, M devices firstly obtain w ═ g through interactive calculation_B^(r₁r₂...r_m) Wherein r is_iThe device No. i is in [1, n-1 ] in the calculation process]An integer randomly selected within the interval, i ═ 1.., m;

then, H ═ H is calculated (by one of the m devices or the other device)₂(M | | w, n), wherein H₂For the hash function specified in SM9, M | | | w represents the merging of strings of M and w, and n is G₁、G₂、G_TThe order of (1);

(h free transfer as required without privacy)

Checking whether w is equal to g ^ h or not (one or other of the m devices), and if w is equal to g ^ h, the m devices perform calculation of w again until w is not equal to g ^ h;

then, Q is calculated₁＝[(r₂r₃...r_m)^-1]P_A，Q₂＝[(r₃…r_m)^-1]P_A，...，Q_m-1＝[(r_m)^-1]P_ATaking Q_m＝P_A；

Get S₀＝P_B；

Device number 1 calculates S₁＝[r₁]S₀+[-c₁h]Q₁Wherein r is₁And r when calculating w₁Same, howeverWill S₁To device No. 2;

the device No. i receives S_i-1Then, if S is found by inspection, i is 2_i-1If it is zero, error is reported, otherwise S is calculated_i＝[r_i]S_i-1+[-c_ih]Q_iWherein r is_iAnd r when calculating w_iThe same; where if i is m, c_m＝0；

If i is m, then S is ended₁,S₂,...,S_mOtherwise, will S_iTransmitting to the device No. i + 1;

device m gets S ═ S_mAnd checking the validity of the digital signature of the message M as (h, S), if the digital signature of the message M is valid, (h, S) is the digital signature of the message M, and otherwise, the M-th device reports an error.

(where S is [ r ]₁r₂...r_m]P_B+[-c₁hr₂...r_m]Q₁+[-c₂hr₃...r_m]Q₂+...+[-c_m-1hr_m]Q_m-1＝[r₁r₂…r_m]P_B+[-(c₁+c₂+...+c_m-1)h]P_A＝[(r₁r₂...r_m)b-h]d_A)

For this embodiment, during the initialization phase, d may be known_AIn (one or more than one of the m devices) at [1, n-1 ]]In the random selection of m-1 integers c_i1, m-1, check (c)₁+c₂+...+c_m-1) Whether mod n is 0 or not, and if so, at [1, n-1]Reselecting m-1 integers until (c)₁+c₂+...+c_m-1) mod n is not 0;

if (c)₁+c₂+...+c_m-1) mod n is not 0, then c is_iThe device No. i is handed over to be kept as a secret, i 1_m＝0)；

Then knows d_AMeans for calculating P_A＝[c^-1]d_AWherein c is^-1Modulo n multiplication inverse of c, c ═ c₁+c₂+...+c_m-1)mod n；

Then knows d_AIn [1, n-1 ]]In the sequence, an integer b is randomly selected and b is not equal to c^-1Calculate P_B＝[b]d_A；

Finally P is added_ADelivering to the m-th device as secret to store P_BGiving the required devices c, b and d_AAnd (4) destroying.

In the above examples 1-4, m devices calculated w ═ g_B^(r₁r₂...r_m) The method of (1) comprises (not all possible ways):

device No. 1 calculates g₁＝g_B^r₁G is mixing₁Transmitting device No. 2;

the device No. i receives g_i-1Then, i is 2_i＝g_i-1^r_i；

If i is m, w is g_mFinish the calculation, otherwise, get the device g No. i_iTransmitting to the device No. i + 1;

alternatively, the first and second electrodes may be,

device m calculates g_m＝g_B^r_mG is mixing_mTransmitting the m-1 device;

the ith device receives g_i+1Then, i ═ m-1, calculate g_i＝g_i+1^r_i；

If i is 1, w is g₁Finish the calculation, otherwise, get the device g No. i_iTo the device No. i-1.

In the above embodiments 1-4, if it is not checked whether w is equal to g ^ h or not during the calculation process, after S is obtained through calculation, if S is found to be zero, m devices perform the cooperative calculation again until S is not zero.

In the above examples 1 to 4, Q was calculated₁＝[(r₂r₃...r_m)^-1]P_A，Q₂＝[(r₃...r_m)^-1]P_A，...，Q_m-1＝[(r_m)^-1]P_AIn a manner asThe following:

device No. m takes Q_m＝P_ACalculating Q_m-1＝[(r_m)^-1]Q_mIs mixing Q with_m-1Sending the data to the device No. m-1;

device i receives Q_iThen, if i is equal to 1, device No. 1 will Q₁Temporarily reserved, complete Q₁,Q₂,...,Q_m-1Otherwise, the ith device calculates Q_i-1＝[(r_i)^-1]Q_iIs mixing Q with_iTemporarily reserve, Q_i-1To the device No. i-1.

According to the SM9 digital signature multi-party collaborative generation method with the product r parameter, a corresponding SM9 digital signature collaborative generation system can be constructed, the system comprises m devices which are respectively marked as No. 1, No. 2, and No. 2, wherein m is more than or equal to 2; device No. i holds [1, n-1 ]]Integer secret c within interval_iI 1.., m; when it is desired to use the user's SM9 to identify the private key d_AWhen the message M is digitally signed, the M devices generate the digital signature aiming at the message M according to the SM9 digital signature multiparty collaborative generation method with the product r parameter; in particular, if c is taken_mIs equal to 0, and P is_AStored as a secret by the m-th device, and b ≠ c^-1(i.e. P)_B≠P_A) Then S is calculated according to the SM9 digital signature multiparty collaborative generation method with the product r parameter_m(in this case [ -c ]_mh]Q_mZero) device m gets S ═ S_mAnd (h, S) is checked as validity of the digital signature of the message M, if valid, (h, S) is the digital signature for the message M, otherwise, the mth device reports an error.

Other specific technical implementations not described are well known to those skilled in the relevant art and will be apparent to those skilled in the relevant art.

Claims (6)

1. An SM9 digital signature multi-party collaborative generation method with a product r parameter is characterized in that:

the method involves m devices numbered 1, 2, …, respectively, up to m, where m is greater than or equal to 2;

device No. i holds [1, n-1 ]]Integer secret c within interval_iI is 1, …, m, where n is group G in the SM9 cryptographic algorithm₁、G₂、G_TA step of (a), (b), and (c)₁+c₂+…+c_m)mod n≠0；

The method comprises the following steps:

P_A＝[c^-1]d_Awherein d is_AIdentify the private key for the user's SM9, c^-1Modulo n multiplication inverse of c, c ═ c₁+c₂+…+c_m) mod n is an integer secret that is not held by all m devices;

P_B＝[b]d_Awherein b is [1, n-1 ]]None of the m devices within the interval have a saved integer secret;

b and c^-1Do not have to be different;

g_Bg ^ b, where ^ b is an exponentiation, g ^ e (P)₁,P_pub)，P₁Is G₁The generator of (1), P_pubIs a master public key;

none of the m devices store d_A；

When it is desired to use the user's SM9 to identify the private key d_AWhen a digital signature is performed on a message M, M devices generate digital signatures as follows:

firstly, m devices obtain w ═ g through interactive calculation_B^(r₁r₂…r_m) Wherein r is_iThe device No. i is in [1, n-1 ] in the calculation process]Randomly selected integer in the interval, i ═ 1, …, m;

then, H is calculated as H₂(M | | w, n), wherein H₂For the hash function specified in SM9, M | | | w represents the merging of strings of M and w, and n is G₁、G₂、G_TThe order of (1);

checking whether w is equal to g ^ h or not, if w is equal to g ^ h, the m devices carry out calculation of w again until w is not equal to g ^ h;

then, Q is calculated₁＝[(r₂r₃…r_m)^-1]P_A，Q₂＝[(r₃…r_m)^-1]P_A，…，Q_m-1＝[(r_m)^-1]P_ATaking Q_m＝P_A；

Get S₀＝P_B；

Device number 1 calculates S₁＝[r₁]S₀+[-c₁h]Q₁Wherein r is₁And r when calculating w₁Same, then S₁To device No. 2;

the device No. i receives S_i-1When i is 2, …, m, S is found by examination_i-1If it is zero, error is reported, otherwise S is calculated_i＝[r_i]S_i-1+[-c_ih]Q_iWherein r is_iAnd r when calculating w_iThe same;

if i is m, then S is S_m(h, S) is the generated digital signature for the message M, otherwise, S is_iTransmitting to the device No. i +1 until S is completed_mAnd (4) calculating.

2. The SM9 digital signature multiparty cooperative generation method with product r parameter as claimed in claim 1, wherein:

m devices calculate w ═ g_B^(r₁r₂…r_m) The method comprises the following steps:

device No. 1 calculates g₁＝g_B^r₁G is mixing₁Transmitting device No. 2;

the device No. i receives g_i-1Then i 2, …, m, calculate g_i＝g_i-1^r_i；

If i is m, then w is g_mFinish the calculation, otherwise, get the device g No. i_iTransmitting to the device No. i + 1;

alternatively, the first and second electrodes may be,

device m calculates g_m＝g_B^r_mG is mixing_mTransmitting the m-1 device;

the ith device receives g_i+1Then, i ═ m-1, …,1, calculate g_i＝g_i+1^r_i；

If i is 1, then w is g₁Finish the calculation, otherwise, get the device g No. i_iTo the device No. i-1.

3. The SM9 digital signature multiparty cooperative generation method with product r parameter as claimed in claim 1, wherein:

if not checking whether w is equal to g ^ h or not in the calculation process, after S is obtained through calculation, if S is found to be zero element through checking, the m devices carry out cooperative calculation again until S is not zero element.

4. The SM9 digital signature multiparty cooperative generation method with product r parameter as claimed in claim 1, wherein:

calculating to obtain Q₁＝[(r₂r₃…r_m)^-1]P_A，Q₂＝[(r₃…r_m)^-1]P_A，…，Q_m-1＝[(r_m)^-1]P_AOne way of (2) is as follows:

device No. m takes Q_m＝P_ACalculating Q_m-1＝[(r_m)^-1]Q_mIs mixing Q with_m-1Sending the data to the device No. m-1;

device i receives Q_iThen, if i is m-1, …,1, and if i is 1, the device No. 1 will Q₁Temporarily reserved, complete Q₁,Q₂,…,Q_m-1Otherwise, the ith device calculates Q_i-1＝[(r_i)^-1]Q_iIs mixing Q with_iTemporarily reserve, Q_i-1To the device No. i-1.

5. The SM9 digital signature multiparty cooperative generation method with product r parameter as claimed in claim 1, wherein:

if get c_m1 is equal to 0 and_Astored as a secret by the m-th device, and b ≠ c^-1Then S is obtained by calculation according to the method_mThen, the m-th device takes S ═ S_mAnd examining (h, S) as XiaoAnd (h, S) aiming at the digital signature of the message M if the digital signature of the message M is valid, otherwise, the M-th device reports an error.

6. An SM9 digital signature cooperative generation system based on the SM9 digital signature multiparty cooperative generation method with product r parameter of any one of claims 1-4, characterized by:

the system comprises m devices respectively numbered from No. 1, No. 2 and No. …, wherein m is more than or equal to 2; device No. i holds [1, n-1 ]]Integer secret c within interval_iI is 1, …, m; when it is desired to use the user's SM9 to identify the private key d_AWhen the message M is digitally signed, the M devices generate the digital signature aiming at the message M according to the SM9 digital signature multiparty collaborative generation method with the product r parameter;

if get c_m1 is equal to 0 and_Astored as a secret by the m-th device, and b ≠ c^-1Then S is calculated according to the SM9 digital signature multiparty collaborative generation method with the product r parameter_mThen, the m-th device takes S ═ S_mAnd (h, S) is checked as validity of the digital signature of the message M, if valid, (h, S) is the digital signature for the message M, otherwise, the mth device reports an error.